Key refresh for small-data traffic

Abstract

Apparatuses, methods, and systems are disclosed for key refresh triggering. One apparatus includes a transceiver and a processor that starts a counter corresponding to a UE having a small-data traffic pattern. In response to the transceiver receiving small-data traffic associated with the UE, the processor determines if a security key is valid based on a value of the counter. If the value of the counter indicates the security key is invalid, then the processor triggers a key refresh procedure. The processor relays the small-data traffic in response to the UE having a valid security key.

The invention claimed is: 
     
       1. A method of a network function comprising:
 identifying a pattern of small-data traffic of a remote unit, where the small-data traffic is protected using a security key; 
 starting a counter corresponding to the remote unit, wherein the counter is for the identified small-data traffic pattern, wherein the counter tracks a number of radio resource control (“RRC”) connection state transitions of the remote unit since the security key was issued, wherein the small-data traffic is transferred over a user plane connection; 
 receiving small-data traffic associated with the remote unit; 
 determining if a security key is valid when the value of the counter does not exceed a predefined limit; 
 triggering a key refresh procedure if the value of the counter indicates that the security key is invalid; and 
 relaying the small-data traffic in response to the remote unit having a valid security key. 
 
     
     
       2. The method of  claim 1 , wherein receiving the small-data traffic comprises receiving an RRC message from the remote unit, wherein the RRC message contains the small-data traffic. 
     
     
       3. The method of  claim 1 , wherein receiving the small-data traffic comprises receiving the small-data traffic from a session management function. 
     
     
       4. The method of  claim 1 , wherein the security key protects an air-interface between the remote unit and a base unit. 
     
     
       5. The method of  claim 1 , wherein the security key is an access stratum (“AS”) key, wherein triggering the key refresh procedure comprises initiating an AS key refresh procedure or performing RRC connection establishment. 
     
     
       6. The method of  claim 1 , wherein the security key is a non-access stratum (“NAS”) key, wherein triggering the key refresh procedure comprises initiating a NAS security mode command (“SMC”) procedure or initiating a NAS key refresh procedure. 
     
     
       7. The method of  claim 1 , wherein the counter tracks a number of RRC-INACTIVE to RRC-CONNECTED state transitions since the security key was issued. 
     
     
       8. The method of  claim 1 , wherein the counter tracks a number of RRC-SUSPEND to RRC-CONNECTED state transitions since the security key was issued. 
     
     
       9. The method of  claim 1 , wherein the user plane connection comprises a Protocol Data Unit (“PDU”) session was activated, wherein the small-data traffic is transferred over the PDU session. 
     
     
       10. The method of  claim 9 , further comprising starting a timer when the PDU session is activated and triggering a key refresh procedure when timer expires. 
     
     
       11. An apparatus comprising:
 a transceiver; and 
 a processor that: 
 identifies a pattern of small-data traffic of a remote unit, wherein the small-data traffic is protected using a security key; 
 starts a counter corresponding to a remote unit, wherein the counter tracks a number of radio resource control (“RRC”) connection state transitions of the remote unit since the security key was issued, wherein the small-data traffic is transferred over a user plane connection; 
 determines that a security key is valid based on a value of the counter not exceeding a predefined limit, in response to the transceiver receiving small-data traffic associated with the remote unit; 
 triggers a key refresh procedure if the value of the counter indicates the security key is invalid; and 
 relays the small-data traffic in response to the remote unit having a valid security key. 
 
     
     
       12. The apparatus of  claim 11 , wherein receiving the small-data traffic comprises receiving an RRC message from the remote unit, wherein the RRC message contains the small-data traffic. 
     
     
       13. The apparatus of  claim 11 , wherein receiving the small-data traffic comprises receiving the small-data traffic from a session management function. 
     
     
       14. The apparatus of  claim 11 , wherein the security key protects an air-interface between the remote unit and a base unit. 
     
     
       15. The apparatus of  claim 11 , wherein the security key is an access stratum (“AS”) key, wherein triggering the key refresh procedure comprises initiating an AS key refresh procedure or performing RRC connection establishment. 
     
     
       16. The apparatus of  claim 11 , wherein the security key is a non-access stratum (“NAS”) key, wherein triggering the key refresh procedure comprises initiating a NAS security mode command (“SMC”) procedure or initiating a NAS key refresh procedure. 
     
     
       17. The apparatus of  claim 11 , wherein the counter tracks a number of RRC-INACTIVE to RRC-CONNECTED state transitions since the security key was issued. 
     
     
       18. The apparatus of  claim 11 , wherein the counter tracks a number of RRC-SUSPEND to RRC-CONNECTED state transitions since the security key was issued. 
     
     
       19. The apparatus of  claim 11 , wherein the user plane connection comprises a Protocol Data Unit (“PDU”) session was activated, wherein the small-data traffic is transferred over the PDU session. 
     
     
       20. The apparatus of  claim 19 , wherein the processor starts a timer when the PDU session is activated and triggering a key refresh procedure when timer expires.